CVE-2025-27621
Received Received - Intake

Authentication Bypass in UpTrain via Default API Key

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using these two primitives, any website can make a authenticated cross-origin request to the UpTrain instance by providing the default API key in the header `uptrain-access-token`. This issue may allow arbitrary websites to perform privileged operations on the UpTrain instance, as if they were the default logged in user. As of time of publication, no known patches are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2025-27621
EUVD
EUVD-2025-210733

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
uptrain-ai uptrain to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

UpTrain versions 0.7.1 and prior have a vulnerability where the backend creates a default user with a static username used as an API key. Combined with an open CORS policy, any website can make authenticated cross-origin requests to the UpTrain instance by including the default API key in headers. This allows arbitrary websites to perform privileged operations as the default user.

Detection Guidance

Check if your UpTrain instance is running version 0.7.1 or earlier. Verify if the default API key is enabled and if CORS is open. Inspect network traffic for unauthorized cross-origin requests using the static API key.

Impact Analysis

This vulnerability may allow attackers to execute arbitrary code on the UpTrain host, typically running in a Docker container, by tricking a user into visiting a malicious website. It could lead to unauthorized data access, manipulation, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies

Immediately upgrade to a patched version if available. Disable the default API key and restrict CORS policies. Block external access to the /create_project endpoint and review API methods for proper user-specific access controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-27621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart